Subprocessors
Last updated 2026-10-21.
These are the third parties that process customer data on our behalf in order to run the service. We notify customers before adding a new one.
| Provider | Purpose | Location |
|---|---|---|
| Heroku (Salesforce, Inc.) | Runs the application and its Postgres database, which stores all customer data | EU (AWS, Ireland). US-owned (SCCs) |
| Brevo | Sends sign-in links and the weekly review digest | EU |
| Stripe | Merchant of record. Sells the subscription and handles payment and tax. Stripe is the seller on your invoice, and holds the card, the billing address and the tax id; we do not. Stripe never receives register content. | EU / US (SCCs) |
| PostHog | Error reports, and product analytics for people who allow them | EU |
| Bunny | Stores encrypted copies of the database backups | EU |
What they receive
Heroku processes everything by necessity, because it runs the service. Brevo receives recipient addresses and the contents of the messages we send, which for the weekly digest includes risk titles and counts. Stripe receives billing details only and never sees your register.
PostHog receives two things. When something breaks, an error report: the kind of error, where in our code it happened, and the page's pattern rather than its address. It holds no names, email addresses or register content. If you allow analytics, which pages you open and which buttons you press, with all on-screen text and link targets removed, keyed by your account's id and never your email. There is no session recording.
Bunny receives backups that are encrypted before they leave the application, with a key that is held offline. It cannot read them.
We use no advertising tools. Every script the application runs is served from our own domain, including PostHog's, which is only loaded after you allow it.